@nggaigc/cli 0.1.10 → 0.1.13

package/dist/install.js

@@ -8,7 +8,7 @@ import { CliError, fixedErrorCode } from "./errors.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.11.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.15.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };
@@ -17,9 +17,10 @@ function validateRuntime(platform, architecture) {
     const [major, minor] = process.versions.node.split(".").map(Number);
     if (!((major === 22 && (minor ?? 0) >= 13) || major === 24))
         throw new CliError("RUNTIME_UNSUPPORTED");
-    if (platform !== "win32")
+    if (platform !== "win32" && platform !== "darwin")
         throw new CliError("UNSUPPORTED_PLATFORM");
-    if (architecture !== "x64" && architecture !== "arm64")
+    if ((platform === "darwin" && architecture !== "arm64") ||
+        (platform === "win32" && architecture !== "x64" && architecture !== "arm64"))
         throw new CliError("UNSUPPORTED_PLATFORM");
 }
 function safeProfile(value) {
@@ -27,6 +28,14 @@ function safeProfile(value) {
         throw new CliError("INVALID_INPUT");
     return path.resolve(value);
 }
+function installationError(error) {
+    const code = fixedErrorCode(error);
+    if (["SKILL_PAIR_UPGRADE_REQUIRED", "SKILL_PAIR_UNSAFE"].includes(code ?? ""))
+        return new CliError("SKILL_PAIR_UPGRADE_REQUIRED");
+    if (["SKILL_PAIR_RECOVERY_REQUIRED", "SKILL_PAIR_SOURCE_INVALID"].includes(code ?? ""))
+        return new CliError("SKILL_PAIR_RECOVERY_REQUIRED");
+    return new CliError("INSTALLATION_FAILED");
+}
 async function installedVersion(target) {
     try {
         const marker = JSON.parse(await readFile(path.join(target, ".nggaigc-install.json"), "utf8"));
@@ -64,7 +73,7 @@ async function installSkill(installer, source, profile, codexHome, expectedVersi
     }
     catch (error) {
         if (fixedErrorCode(error) !== "ALREADY_INSTALLED")
-            throw new CliError("INSTALLATION_FAILED");
+            throw installationError(error);
     }
     const currentVersion = await installedVersion(target);
     if (!currentVersion)
@@ -83,8 +92,8 @@ async function installSkill(installer, source, profile, codexHome, expectedVersi
         await verifyInstalledSkill(target, bundleFiles);
         return "updated";
     }
-    catch {
-        throw new CliError("INSTALLATION_FAILED");
+    catch (error) {
+        throw installationError(error);
     }
 }
 async function connect(launcher, options, report, probe) {
@@ -106,6 +115,8 @@ async function connect(launcher, options, report, probe) {
     catch (error) {
         if (!probe && fixedErrorCode(error) === "SETUP_REQUIRED")
             configured = false;
+        else if (fixedErrorCode(error) === "POWERSHELL_EXECUTION_POLICY_BLOCKED")
+            throw new CliError("POWERSHELL_EXECUTION_POLICY_BLOCKED");
         else
             throw new CliError("CONNECTION_VERIFICATION_FAILED");
     }
@@ -118,6 +129,9 @@ async function connect(launcher, options, report, probe) {
             const upstreamBrowserOpened = typeof options?.browserOpened === "function"
                 ? options.browserOpened
                 : undefined;
+            const upstreamBrowserFallback = typeof options?.browserFallback === "function"
+                ? options.browserFallback
+                : undefined;
             const upstreamSignal = options?.signal;
             const result = await launcher.main(["login"], {
                 ...options,
@@ -128,6 +142,12 @@ async function connect(launcher, options, report, probe) {
                     upstreamBrowserOpened?.();
                     report("authorizing");
                 },
+                browserFallback: upstreamBrowserFallback
+                    ? async (url) => {
+                        await upstreamBrowserFallback(url);
+                        report("manual-authorizing");
+                    }
+                    : undefined,
             });
             if (result === null ||
                 typeof result !== "object" ||
@@ -138,6 +158,8 @@ async function connect(launcher, options, report, probe) {
         catch (error) {
             if (fixedErrorCode(error) === "BROWSER_OPEN_FAILED")
                 throw new CliError("BROWSER_OPEN_FAILED");
+            if (fixedErrorCode(error) === "POWERSHELL_EXECUTION_POLICY_BLOCKED")
+                throw new CliError("POWERSHELL_EXECUTION_POLICY_BLOCKED");
             throw new CliError("BROWSER_AUTHORIZATION_FAILED");
         }
         finally {
@@ -162,12 +184,14 @@ export async function runInstall(options = {}) {
     const report = options.reporter ?? (() => undefined);
     report("verifying");
     const bundle = await verifyBundle(options.bundle ?? defaultBundle());
+    if (!bundle.platforms.includes(`${options.platform ?? process.platform}-${options.architecture ?? process.arch}`))
+        throw new CliError("UNSUPPORTED_PLATFORM");
     const temporaryParent = path.resolve(options.temporaryRoot ?? os.tmpdir());
     const temporary = await mkdtemp(path.join(temporaryParent, "nggaigc-cli-"));
     assertDisposableRoot(temporary, temporaryParent);
     try {
         const extracted = path.join(temporary, "plugin");
-        await extractBundle(bundle.archive, extracted);
+        await extractBundle(bundle.archive, extracted, bundle.sha256);
         await verifyExtractedBundle(extracted, bundle.files);
         report("installing");
         const require = createRequire(import.meta.url);
@@ -181,8 +205,20 @@ export async function runInstall(options = {}) {
             typeof launcher.main !== "function" ||
             typeof launcher.LauncherError !== "function")
             throw new CliError("INSTALLATION_FAILED");
-        await connect(launcher, options.launcherOptionsFactory?.(launcher), report, options.connectionProbe);
-        return { status: "connected", installation, version: bundle.version };
+        try {
+            await connect(launcher, options.launcherOptionsFactory?.(launcher), report, options.connectionProbe);
+            return { status: "connected", installation, version: bundle.version };
+        }
+        catch (error) {
+            if (!(error instanceof CliError))
+                throw error;
+            return {
+                status: "installed-unconnected",
+                installation,
+                version: bundle.version,
+                connectionError: error.code,
+            };
+        }
     }
     finally {
         assertDisposableRoot(temporary, temporaryParent);

package/dist/skill-command.js

@@ -0,0 +1,115 @@
+import { createHash, createPublicKey } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { trustedKeyId, trustedKeySpkiSha256, verifyBundle, verifyInstalledSkill, } from "./bundle.js";
+import { IndependentSkillError, projectActiveSkillCatalog, startIndependentSkill, } from "./independent-skill.js";
+function fail(code) {
+    throw new IndependentSkillError(code);
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function productionDependencies(codexHome) {
+    const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
+    const bundle = await verifyBundle({
+        archive: path.join(vendor, "nggaigc-plugin-1.1.15.zip"),
+        manifest: path.join(vendor, "manifest.json"),
+        trust: path.join(vendor, "trusted-keys.json"),
+    });
+    const root = path.join(codexHome, "skills", "nggaigc");
+    await verifyInstalledSkill(root, bundle.files);
+    const source = JSON.parse(await readFile(path.join(root, "references", "source.json"), "utf8"));
+    if (!record(source) ||
+        source.id !== "skill.nggaigc" ||
+        typeof source.version !== "string" ||
+        !/^\d+\.\d+\.\d+$/.test(source.version) ||
+        source.clientProtocol !== 1)
+        fail("ROOT_UNAVAILABLE");
+    const keys = JSON.parse(await readFile(path.join(vendor, "trusted-keys.json"), "utf8"));
+    if (!record(keys) ||
+        keys.schemaVersion !== "ngg-trusted-package-keys/v1" ||
+        !Array.isArray(keys.keys))
+        fail("TRUST_UNAVAILABLE");
+    const match = keys.keys.find((key) => record(key) &&
+        key.keyId === trustedKeyId &&
+        typeof key.publicKeyPem === "string");
+    if (!record(match) || typeof match.publicKeyPem !== "string")
+        fail("TRUST_UNAVAILABLE");
+    const key = createPublicKey(match.publicKeyPem);
+    const fingerprint = createHash("sha256")
+        .update(key.export({ type: "spki", format: "der" }))
+        .digest("hex");
+    if (fingerprint !== trustedKeySpkiSha256)
+        fail("TRUST_UNAVAILABLE");
+    const require = createRequire(import.meta.url);
+    const launcher = require(path.join(root, "scripts", "launch-ngg-client.cjs"));
+    if (!record(launcher) || typeof launcher.main !== "function")
+        fail("ROOT_UNAVAILABLE");
+    return {
+        launcher: launcher,
+        trust: {
+            keyId: trustedKeyId,
+            publicKeyPem: match.publicKeyPem,
+            spkiSha256: fingerprint,
+        },
+        rootSkillVersion: source.version,
+    };
+}
+/** Candidate npm entry: active catalog → server admission → verified local Skill path. */
+export async function runSkillStartCommand(skillId, skillVersion, options = {}) {
+    if (!/^skill\.[a-z0-9][a-z0-9.-]{0,79}$/.test(skillId) ||
+        (skillVersion !== undefined && !/^\d+\.\d+\.\d+$/.test(skillVersion)))
+        fail("INVALID_INPUT");
+    const codexHome = path.resolve(options.codexHome ??
+        process.env.CODEX_HOME ??
+        path.join(os.homedir(), ".codex"));
+    if (!path.isAbsolute(codexHome))
+        fail("INSTALL_PATH_UNSAFE");
+    const production = options.launcher && options.trust && options.rootSkillVersion
+        ? null
+        : await productionDependencies(codexHome);
+    const launcher = options.launcher ?? production.launcher;
+    const trust = options.trust ?? production.trust;
+    const rootSkillVersion = options.rootSkillVersion ?? production.rootSkillVersion;
+    const platformVersion = options.platformVersion ??
+        JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8")).version;
+    let snapshot;
+    try {
+        snapshot = await launcher.main(["catalog-snapshot"]);
+    }
+    catch {
+        fail("CATALOG_UNAVAILABLE");
+    }
+    const index = projectActiveSkillCatalog(snapshot);
+    const matches = index.entries.filter((entry) => entry.id === skillId &&
+        entry.state === "active" &&
+        entry.sourceManifest?.role === "independent_skill" &&
+        (skillVersion === undefined || entry.version === skillVersion));
+    if (matches.length !== 1)
+        fail("SKILL_UNAVAILABLE");
+    const selected = matches[0];
+    return startIndependentSkill({
+        index,
+        skillId: selected.id,
+        skillVersion: selected.version,
+        rootSkillVersion,
+        platformVersion,
+        codexHome,
+        trust,
+        fetcher: options.fetcher,
+        admit: async (identity) => {
+            const answer = await launcher.main([
+                "skill-admit",
+                identity.kind,
+                identity.id,
+                identity.version,
+                identity.manifestSha256,
+                identity.releaseId,
+            ]);
+            return answer;
+        },
+    });
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.10",
-  "description": "Secure one-command NGGAIGC Skill installer for Codex on Windows.",
+  "version": "0.1.13",
+  "description": "Secure one-command NGGAIGC Skill installer for Codex.",
   "type": "module",
   "bin": {
     "nggaigc": "dist/bin.js"
@@ -15,18 +15,18 @@
     "node": ">=22.13.0 <23 || >=24.0.0 <25"
   },
   "os": [
-    "win32"
+    "win32",
+    "darwin"
   ],
   "cpu": [
     "x64",
     "arm64"
   ],
+  "license": "UNLICENSED",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepack": "tsc -p tsconfig.build.json && node scripts/stage-assets.mjs",
     "test": "vitest run src --exclude 'src/windows-secure-store.integration.test.ts'",
     "test:credential:os": "tsc -p tsconfig.build.json && vitest run src/windows-secure-store.integration.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit"
-  },
-  "license": "UNLICENSED"
-}
+  }
+}

package/vendor/manifest.json

@@ -1,33 +1,43 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.11",
-  "sourceCommit": "8140d08b8361a46f6b2df6e18fab2343b80e1e8c",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.11.zip",
-  "sha256": "0bfd5f96468b3bf380e8620c1f425638f82c025561d957f456585b9b4762aa89",
-  "sizeBytes": 125253,
-  "fileCount": 11,
+  "version": "1.1.15",
+  "sourceCommit": "c62957847daec8e60105d31e083a1309c8dd5846",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.15.zip",
+  "sha256": "ef47a2e18e55eb21512f094796cacda1915056cd09d88b04c89e2074537d9d22",
+  "sizeBytes": 339122,
+  "fileCount": 20,
   "platforms": [
     "win32-x64",
-    "win32-arm64"
+    "win32-arm64",
+    "darwin-arm64"
   ],
   "files": {
-    ".codex-plugin/plugin.json": "b9e38baab4fb64421058eb4ef50680ff59679bfe56488a0b13b49785430f7a0b",
-    "installer/install.cjs": "34f4196d59a911f983311b0a79192b23112cdeeb5455cb57609f121bb3e55ea8",
+    ".codex-plugin/plugin.json": "0e7bbafaf6cab9f7eb5f7836c6579f7544c236e1de678b825922c87b6cb4c781",
+    "installer/install.cjs": "73d2c16f2a3697007576835bd9b87ea0ecc4c9b7d9616db1b70c45c1350a4f41",
+    "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
+    "migration/seedream-1.1.1/SKILL.md": "a1b49a9440443547c65f3dd4a77efc61feffcc53f1462084a5512c67af83d18c",
+    "migration/seedream-1.1.1/agents/openai.yaml": "3cbf034ddccd64a7972acd37e7433683a3944f3d8c7b5bdccbbd70e517bf5a8c",
+    "migration/seedream-1.1.1/references/image-generation.md": "a69a9ae3e1e42bdeb5e8a168ec598cc8e1af9caa1d50a76732bd85d47283f2ca",
+    "migration/seedream-1.1.1/references/source.json": "fb89c461b7ef587ebd8e9ceaa7b3128d0766f2004ee437c261c0d5ec25a31ce8",
+    "migration/seedream-1.1.1/scripts/seedream.mjs": "67334b3de175c47f994448723a946c87fcd56f4ef1882206346b44e301a82054",
+    "skills/nggaigc/SKILL.md": "935970e818e5a60839c5f68738889f22eaae4fc85a0c4bf9a0a89f0571d17403",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
-    "skills/nggaigc/references/catalog-and-updates.md": "415116b71650282322ef37407d12799a5292ea2d60e9e0d2f8a6346c1c86c1d4",
-    "skills/nggaigc/references/source.json": "bcf6e14101db192ff9079c788df131c6b94ccd6d5abfd667dfc8c838b7d6dc1e",
-    "skills/nggaigc/scripts/bootstrap-public.json": "743d7e79ff50dce837475841cda075ff33bb4e4fa32ee5771aa68e47e10b546a",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "dc4587a196c0fba4daa00124034b4726ec099eb78d48c926bd2622ed9faa551b",
-    "skills/nggaigc/scripts/ngg_client.mjs": "b375237938a3c99339d0efaa31a0df7503651a87f5e02d3cef795e15d3d72245",
-    "skills/nggaigc/scripts/ngg-session.mjs": "6d535b051b71204847865c0f0130d3dd44fc0ad003b1be85f5e37e1040aada37",
-    "skills/nggaigc/scripts/windows-credential.ps1": "ce097f2a8601664522fcfa8c9505243439ff786a45f15a1dba702b8f9b13dab1",
-    "skills/nggaigc/SKILL.md": "4dc2709af3022c34772eebadb98f36cde5d141fde59dfa9a0e0559535ae56f54"
+    "skills/nggaigc/references/catalog-and-updates.md": "638357c1d7a5170dc4a0ce635a08e148ef440f69ce51251bc2a053b0871589a9",
+    "skills/nggaigc/references/source.json": "73d451f17beb6e4dcbee7a03f0d77d3b4c60a0660d4d8d108abe1ddd9dda9884",
+    "skills/nggaigc/scripts/bootstrap-public.json": "adff59ac1ee2347b43d49f679f9e5f5073d594cfaea374788c63a747ad7047e3",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "2afb99bcbc2cbbb90372a3853e69f38d6d21188d35e221c2c685df012edc5434",
+    "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
+    "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
+    "skills/nggaigc/scripts/ngg-session.mjs": "b97506546f049f0f5a2fb8f585ab66136485aae88f4bffa0c24ec672837935dc",
+    "skills/nggaigc/scripts/ngg_client.mjs": "3775891ddc4ed344358bbd0af8cfc403cee226ca9a12c383c701e84264079b4d",
+    "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
+    "skills/nggaigc/scripts/windows-credential.ps1": "ce097f2a8601664522fcfa8c9505243439ff786a45f15a1dba702b8f9b13dab1"
   },
   "signature": {
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "LUKadwdAcUeqqRqp5aE3kH1GiIObpIqhkEXFpNXdrYi9cNYoVDyIF5pItmDHd9tnDq1KS38jluQf/m6StwnlCA=="
+    "value": "k8qg2D/I4XxwQ4YDroE3sVH7C2IlSusEoxeoEVuUwZmyb3O2Q5+jl6P+s+LWDFD2hi8S8xbAiruLb2G4kivXBA=="
   }
 }